Name the define/endef hole in the lint-once header

A `define EXTRA ... endef` body pulled into a recipe as $(EXTRA) gives
`make check` a second prettier pass that the walk still scores as one.
The parser expands no variables, so this is a name it cannot resolve,
not a body it declines to read. The header's exclusion list says so
rather than claiming coverage the code does not have.

test/packaging/lint-once.test.ts

@@ -31,9 +31,12 @@
 // `include`d makefile, a name outside those charsets, a generated file — is
 // not followed. Recipe lines reached through a make conditional are followed,
 // without evaluating the condition, and so is a recipe written on the target
-// line after a `;`; a recipe built by an `include`d makefile, a pattern rule,
+// line after a `;`. A recipe reached some other way is not: an `include`d
-// or a target name outside that charset is not. Within those edges, a prettier
+// makefile, a pattern rule, a target name outside that charset, or a `define`
-// call is caught wherever it is added.
+// block pulled into a recipe as `$(NAME)` — that last one is variable
+// expansion, and this parser expands no variables, so `$(EXTRA)` in a recipe
+// is a name it cannot resolve rather than a body it declines to read. Within
+// those edges, a prettier call is caught wherever it is added.
 //
 // Two entrypoints are walked, because they cover different graphs: `make check`
 // is what a developer runs, and `.gitea/workflows/check.yml` is what CI runs.